In communication networks, it is sometimes advantageous to recognize and specially treat messages including selected application protocols. Many communication networks use a multi-level protocol schema, in which more sophisticated protocols are carried as payload information for less sophisticated protocols. One such multi-level protocol schema is the OSI/ISO model, including distinct protocol levels from level 1 through level 7 inclusive.
One problem in the known art is that it is sometimes difficult to recognize those protocols carried as payload information (level 7 protocols in the OSI/ISO model). They can be difficult to recognize in part because such recognition involves decoding each succeeding level of application protocol, with the intent of detecting the particular level 7 protocol desired to be detected. They can also be difficult to recognize in part because those application protocols might be encrypted, with the intent of preventing outsiders to the protocol communication from reading or even detecting the use of that particular application protocol. They can also be difficult to recognize in part because the application protocols, even if unencrypted, may not be known to the communication network, and can therefore not be parsed as messages traverse the network.
One known method for detecting particular application protocols is to attempt “deep packet” inspection of some or all message packets, with the intent of detecting content believed to be characteristic of the particular application protocol desired to be detected. While this method might have some value in detecting particular application protocols when those application protocols are (1) relatively easy to decode, (2) unencrypted, and (3) understood by the communication network, it is subject to drawbacks when those conditions are not true.